Cloud users whose password never expires

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Users
# Users with DisablePasswordExpiration in passwordPolicies, oldest password first. Read-only.

Connect-MgGraph -Scopes 'User.Read.All' -NoWelcome

Get-MgUser -All -Property 'id', 'displayName', 'userPrincipalName', 'accountEnabled', 'passwordPolicies', 'lastPasswordChangeDateTime', 'onPremisesSyncEnabled' |
    Where-Object { "$($_.PasswordPolicies)" -match 'DisablePasswordExpiration' } |
    Sort-Object LastPasswordChangeDateTime |
    Select-Object UserPrincipalName, DisplayName, AccountEnabled, PasswordPolicies, LastPasswordChangeDateTime,
        @{ Name = 'SyncedFromAD'; Expression = { $_.OnPremisesSyncEnabled -eq $true } }

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Reads the user's passwordPolicies property, which can contain DisablePasswordExpiration and DisableStrongPassword. Both flags are shown.
• This is the per-user setting only. The tenant also has a password expiry duration and a "let passwords never expire" setting; Microsoft's password policy page lists both.
• Per that page, by default only accounts that aren't synchronized through Microsoft Entra Connect can be set to never expire. Synced accounts are marked SyncedFromAD.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.